mdsecactivebreach/o365-attack-toolkit

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1122 stars · 225 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Go-based red team toolkit for performing OAuth phishing attacks against Office365 accounts. It uses stolen tokens with the Microsoft Graph API to interactively search emails and files, send spear-phishing emails from compromised mailboxes, and replace documents on OneDrive/SharePoint.

Use cases

• perform oauth phishing attacks against office365 users
• search and download emails from a compromised mailbox
• send spear-phishing emails from a victim's account
• search and download files from onedrive and sharepoint
• backdoor or replace documents in a target's cloud storage
• red team operations against microsoft 365 tenants

When to choose

• you are a red team operator simulating OAuth consent phishing against Office365
• you need interactive post-exploitation access to a compromised Microsoft account via Graph API
• you want to demonstrate risks of malicious OAuth app consent in engagements

When to avoid

• you need a general-purpose Office365 administration or migration tool
• you lack authorization to test the target tenant
• you need a maintained tool with active support and a license
• your target is not using Microsoft cloud services

Facets

cli-tool · maturity maintenance

security osint http-server web-scraping security penetration-testing apis email windows go self-hosted red-team oauth-phishing office365 microsoft-graph penetration-testing linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mdsecactivebreach/o365-attack-toolkit")